Booking privacy policy

Privacy Notice pursuant to section 13 and following of the EU 679/16 Regulation on the protection of natural persons with regard to the processing of personal data (GDPR), relevant to the visits’ booking service of the GSK Vaccines s.r.l. Siena Vaccine Science Centre.

GSK Vaccines Srl (hereinafter GSK or We/Us) is keen to offer to its collaborators, to students, association groups and anyone else interested, the opportunity to visit the Siena Vaccine Science Centre (SVSC).

GSK, the Data Controller, with this privacy policy, is providing information on the processing of personal data that are required for booking and organizing the visits to the Siena Vaccine Science Centre (SVSC), so that it is understood:

  • what personal information we collect;
  • how we collect personal data;
  • how we use personal data;
  • on what legal basis we use personal data;
  • what purposes we use personal data for;
  • for how long we keep personal data;
  • with whom we share personal data;
  • Countries to which we may transfer personal data and security measures;
  • Individuals‘ Rights

What personal information we collect

For the purposes indicated below, we collect and process the following personal data: basic personal information (e.g.: name and surname; name of the school/institution including, for groups of students the relevant school year); contact details (email, phone/mobile number); information on day and time of the visit to the SVSC.

How we collect personal data

The personal data, as described above, will be collected when filling out the information request form as well as when filling out the request to book a tour of the SVSC, available on the website www.svsc.it.

How we use the personal data

We will process personal data mainly with computerized means, for the purpose pertaining to the organization of the visits to the SVSC, namely: reply to the information requests, manage the bookings and arrage the visits, as well as managing insurance aspects for visiting the SVSC.

On what legal basis we use personal data

We process personal data to:

  1. reply to the requests of information, manage the bookings and ensure the performance of the requested service;
  2. fulfil our insurance obligations, related to the presence of visitors at the SVSC on the day of the visit.

For these reasons, the lawfullness of the processing is in application of art. 6 paragraph b) of the GDPR, namely “the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.

What purposes we use personal data for.

The personal data, may be processed solely by GSK or by the Third Parties that GSK has engaged for and appointed as Data Processor(s) and only for the following purposes:

  • management and organization of the visits to the SVSC and for insurance purposes.

For how long we keep personal data

Personal data will be retained for the time necessary to achieve the purposes for which they were collected, and in any case for a maximum period of 15 months, afterwards, personal data will be deleted or anonimized.

With whom we share personal data

Only the authorised personnel and/or data processors designated by GSK in writing, and who have received specific instructions may access personal data. This may inlcude the GSK personnel to whom We have entrusted the management of the bookings,as well as professionals or third parties that GSK has engaged for the execution of specific activities and who operate on behalf of GSK (for example the third party that develops and supplies the website of the SVSC or the third party that arrange the tours of the external visitors). 

Countries to which we may transfer personal data and security measures

The transfer of the personal data collected through the booking platform, outside the European Union is not envisaged.

GSK implements appropriate technical and organizational security measures to protect personal data from unauthorized access, use, dissemination, alteration or destruction.

Individuals’ Rights

Individuals may exercise their rights pursuant Article 12 and following of the GDPR, including, by way of example, the right to request information from GSK on the processing, to object to the processing and to lodge a complaint to the Data Protection Authority (Garante) in the event of violation of one's rights or if one has suffered any prejudice due to a processing that does not comply with the law.

Individuals exercise their rights, with a request addressed with no formalities to the Data Controller or to the Data Protection Officer by postmail to GSK Vaccines S.r.l., Via Fiorentina 1, 53100, Siena or by emailing to it.cpa@gsk.com. A feedback will be provided to the request, without delay.